Privacy Policy

Content Carousel is operated by Jacob Perks, trading as Thunkle, a sole proprietorship based in Ottawa, Ontario, Canada. Thunkle is accountable for the personal information described here and is the controller where that term applies. Contact: jacob@thunkle.ai.

• Account information: your email address, account identifiers and workspace membership.
• Google sign-in information: if you choose Sign in with Google, we receive your Google account identifier, name, email address and profile image from Google so we can create and authenticate your Content Carousel account.
• Brand and content information: submitted websites, public webpage text, brand names, briefs, product details, logos, colours, fonts, approved tools, generated slideshows, videos and captions.
• Billing information: your plan, subscription status, Stripe customer and subscription identifiers, billing periods and invoice records. Stripe handles card information; we do not receive complete card numbers.
• Usage and technical information: generation allowances, job status, errors, security events, and ordinary server information such as IP address, browser type, device type, requested pages and timestamps.
• Communications: information you include when you contact us for support, privacy or billing help.

We use information to authenticate users, research submitted websites, generate and render content, provide downloads, administer plans and billing, answer support requests, prevent misuse, troubleshoot errors, improve reliability, comply with law and enforce our terms. Where consent or a particular legal basis is required, we rely on consent, performance of our contract, legal obligations and our legitimate interest in operating and securing the service, as applicable.

We do not sell personal information or use it for third-party behavioural advertising. We do not send promotional email without the consent required by law.

Google sign-in is optional and is used only to create your account, identify you and keep you signed in. Content Carousel requests only the basic identity and profile information described above. We do not request or access your Gmail messages, Google Drive files, Calendar, contacts or other Google product content.

Supabase processes the authentication exchange and manages your session using essential cookies. We do not use Google user data for advertising, sell it, or send it to AI providers. We share it only with service providers needed to operate authentication and the Content Carousel account, as described below. You can revoke Content Carousel's Google access from your Google Account and request deletion of your Content Carousel account and associated personal information at any time.

When you submit a website, we retrieve selected public pages and use their text and visible brand details to prepare your brand brief. Only submit a website and materials you are authorized to use.

Content generation may use Anthropic and OpenAI API services. The prompts sent to an AI provider can include your brand brief, product information, selected website content, content preferences and draft outputs. We do not intentionally send your payment-card information. Processing by each provider is governed by its commercial/API terms and privacy commitments. AI providers and model configurations may change as the service evolves; this policy will be updated when a change materially affects your information.

We use providers that process information for the purposes above, including:

• Supabase for authentication, database services and file storage;
• Google for optional Google sign-in;
• Render for web application and background-worker hosting;
• Stripe for checkout, subscription billing and invoices;
• Resend for account and subscription email;
• Anthropic and OpenAI for AI processing when enabled;
• public image, icon and website services used to assemble brand assets and content.

We may also disclose information when required by law, to protect users or the service, to investigate fraud or security incidents, or in connection with a financing, sale or reorganization of the business. Providers may process information outside Canada, including in the United States, where it can be subject to local law.

We keep account, brand and generated-content information while your account is active and for a limited period afterward when reasonably needed to provide support, restore service, resolve disputes, prevent abuse or meet legal obligations. Generation and security logs may be retained for a shorter operational period. Canadian tax and transaction records may be retained for at least six years where required.

You may request deletion at any time. We will delete or de-identify information that we no longer need, subject to legal obligations and normal backup-expiry cycles. We will explain any information we must retain when responding to a request.

We use essential authentication cookies to keep you signed in. We also use local or session storage to remember a selected plan and resume an active generation flow, and a service worker to support installation and a limited offline experience. We do not use advertising or cross-site tracking cookies. If that changes, we will update this policy and request consent where required.

We use access controls, tenant separation, private file storage, encrypted network connections and restricted service credentials intended to protect information. No online service can guarantee absolute security. If a breach creates a real risk of significant harm, we will notify affected people and regulators as required by law.

Depending on where you live, you may ask to access, correct, export or delete personal information, withdraw consent, or object to or restrict certain processing. Email jacob@thunkle.ai from your account email so we can verify the request. Under PIPEDA, access requests are normally answered within 30 days, subject to permitted extensions.

You may complain to the Office of the Privacy Commissioner of Canada or another regulator with jurisdiction. We would appreciate the opportunity to address the issue first.

The service is for people aged 18 and older and is not directed to children.

We may update this policy as the service or law changes. The date above shows the latest revision. We will provide additional notice when a change materially affects how we use personal information.